Sign in

v15

latestOpenAPI 3.0.0MIT Licenseraw.githubusercontent.com2026-08-016088119.5 KB
authentication
excludeme

OAuth2 provider callback endpoint

Handles the callback from OAuth2 providers after user authorization. Processes the authorization code and creates a user session. This endpoint is where the signin-vs-signup decision (from the signed flow state claim) and the AUTH_DISABLE_AUTO_SIGNUP gate are actually enforced: on a flow=signin state with an unknown user and the flag enabled, the user is redirected with error=invalid-email-password; on a flow=signup state with an existing user, the user is redirected with error=user-already-exists.

get/signin/provider/{provider}/callback

Path parameters

provider'apple' | 'github' | 'google' | 'linkedin' | 'discord' | 'spotify' | 'twitch' | 'gitlab' | 'bitbucket' | 'workos' | 'azuread' | 'entraid' | 'strava' | 'facebook' | 'windowslive' | 'twitter' required

The name of the social provider

Query parameters

codestring

Authorization code provided by the authentication provider

id_tokenstring

ID token provided by the authentication provider

statestring required

State parameter to avoid CSRF attacks

oauth_tokenstring

OAuth token for the provider (e.g., X)

oauth_verifierstring

OAuth verifier for the provider (e.g., X)

errorstring

Error message if authentication failed

error_descriptionstring

Detailed error description if authentication failed

error_uristring

URI with more information about the error

Response

An error occurred while processing the request

statusinteger required

HTTP status error code

messagestring required

Human-friendly error message

error'default-role-must-be-in-allowed-roles' | 'disabled-endpoint' | 'disabled-user' | 'user-already-exists' | 'email-already-verified' | 'forbidden-anonymous' | 'internal-server-error' | 'invalid-email-password' | 'invalid-request' | 'locale-not-allowed' | 'password-too-short' | 'password-in-hibp-database' | 'redirectTo-not-allowed' | 'role-not-allowed' | 'signup-disabled' | 'unverified-user' | 'user-not-anonymous' | 'invalid-pat' | 'invalid-refresh-token' | 'invalid-ticket' | 'disabled-mfa-totp' | 'no-totp-secret' | 'invalid-totp' | 'mfa-type-not-found' | 'totp-already-active' | 'invalid-state' | 'oauth-token-echange-failed' | 'oauth-profile-fetch-failed' | 'oauth-provider-error' | 'invalid-otp' | 'otp-too-many-attempts' | 'cannot-send-sms' | 'provider-account-already-linked' required

Error code identifying the specific application error

Example response

{
  "status": 400,
  "message": "Invalid email format"
}